Kevin Thomas ✅

Author of the world’s most popular Reverse Engineering Tutorial

SCAN: https://mytechnotalent.com/scan.html
ATTACK: https://mytechnotalent.com/attack.html
HACK: https://mytechnotalent.com/hack.html
BADGES: https://mytechnotalent.com/badges.html

Public Key

npub1a6tv3jafquzm7kckmy4lp7p6tvm5t6muhcf3dg842w2c4pax7ldsu0h50s

NIP-05 Address

[email protected]

Profile Code

nprofile1qqswa9kgew5swpdltvtdj2lslqa9kd69ad7tuyck5r6489v2s7n00kcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dscgy0ex

Publishing to

nostr.mom

nos.lol

relay.damus.io

Author Public Key

npub1a6tv3jafquzm7kckmy4lp7p6tvm5t6muhcf3dg842w2c4pax7ldsu0h50s

Show more details

Last Notes

2026-08-04 21:54:24 GMT

#roadtoDEFCON #RoadToDEFCON34 excited for summer camp!
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/039/461/221/110/954/original/e7e28781d8078ee4.png

2026-08-01 17:53:38 GMT

To prepare for #DEFCON and to get setup for the @npub1dqd…8xy4 incredible DC34 badge, I created a RISC-V repo with a tutorial and with Verilator installed. You simply make setup, make sim and make wave and you are good to go! https://github.com/mytechnotalent/0x00-uart
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/021/527/621/844/523/original/68c455eafbe20a02.png

2026-08-01 11:34:50 GMT

- reply

I am so crazy excited about this years badge and major kudos to Andrew “bunnie” Huang who designed a brilliant RISC-V chip and helping to advance the open-source community. I am so excited to get mine and see this incredible achievement! GREAT JOB!

2026-08-01 00:34:42 GMT

- reply

gorgeous!

2026-07-30 21:50:29 GMT

My goal for the last few decades is to teach the basics from scratch. Here is a tutorial I created to work with RISC-V Assembler on a CH32V003 with a step-by-step tutorial. We begin with 0x00000000 and then a custom handle_reset subroutine. #Embedded #RISCV #ReverseEngineering https://github.com/mytechnotalent/0x00-uart
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/011/133/956/324/940/original/8755b97cc14856ed.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/011/133/956/056/724/original/3ecc69281138d48d.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/117/011/133/972/248/259/original/f316ad42eb20aa0e.png

2026-07-16 15:47:35 GMT

- reply

most welcome

2026-07-16 13:24:19 GMT

- reply

gorgeous

2026-07-08 23:19:52 GMT

- reply

i cant wait to see! Welcome as well!

2026-07-08 23:02:41 GMT

- reply

your work is so great!

2026-07-08 17:52:39 GMT

- reply

so briliant!!!!

2026-07-08 02:58:45 GMT

To my dearest #DEFCON and #badgelife friends,
After months of relentless design and engineering, I am finally releasing what I believe to be an unhackable cryptographic architecture for embedded systems.
I didn't build this for profit. I am releasing this entirely free and open-source because our community deserves the power to create completely impenetrable badges. But my ultimate vision is much larger. I want our community to be the catalyst that forces the entire tech industry to wake up and change.
If we can secure our hardware badges, we can demand the exact same unhackable standard for the devices that actually sustain human life—heart monitors, glucose sensors, and critical medical infrastructure that remain terrifyingly vulnerable today. We must be the ones to effect this change and push the industry forward.
This evolution builds directly upon the foundation of my previous cryptographic engine:
https://github.com/mytechnotalent/ouroboros
The new standard is here, ready to deploy:
https://github.com/mytechnotalent/encryption-c-rp2350
Let’s show the world what true hardware security looks like.
https://files.defcon.social/dcsocial-s3/media_attachments/files/116/882/113/309/189/262/original/3aa0f56668eab485.png

2026-07-07 03:38:05 GMT

I was rejected by the International Association for Cryptologic Research. They said submissions should ‘be clear, readable, and self-contained’, ‘look somewhat new and interesting’, and ‘contain proofs or convincing arguments for any claims’. I was none of these.
The academic establishment is still blindly trusting hardware-backed secure boot, treating it like an infallible standard wrapped in formal proofs. But those proofs are useless in the real world because secure boot relies on logic branches—and logic locks can be glitched.
We have proven that physical fault injection shatters these systems. A $5 voltage glitcher can drop the core voltage for a fraction of a microsecond, force the silicon to skip the signature verification instruction, and bypass the entire security model. The hardware just forgets to check the lock, and the execution door swings wide open.
I tried to explain that the 'proof' against this isn't some elegant equation—it's the fact that the execution is the decryption. If an attacker tries to fault-inject the Speck cipher, it doesn't skip a vulnerable logic gate; it spits out garbage plaintext, fetches invalid opcodes, and hard-faults the processor.
The entire point is that the machine code is inherently unreadable without the correct cryptographic state. There is no master key. The payload is the ciphertext. But apparently, actually building a bare-metal framework that turns physical exploits into a mathematically unsolvable problem isn't 'academic' enough unless it's wrapped in 15 pages of theoretical fluff.

2026-07-06 12:59:59 GMT

I’m excited to finally open-source a project I’ve been heavily refining: the #encryption #crate.
This is a 100% strict, #![no_std] generic #Rust implementation of the Ouroboros #cryptographic engine. I designed it to maintain absolute parity with the security guarantees and constant-time execution of my original #AVR assembly implementation, now brought to the Rust ecosystem.
When teaching #Embedded Systems Reverse Engineering, the vulnerabilities in standard #cryptographic libraries become glaringly obvious at the silicon level. I needed an engine that didn't just look good mathematically, but could actually survive physical and side-channel attacks on bare-metal hardware.
Whether you're targeting an ATmega328P, an RP2350, or testing natively on your host machine, this crate is built for hostile environments.
Here is what is happening under the hood:
1. Speck-128/256 & Davies-Meyer KDF: We are running 24,576 iterations of Speck-256 wrapped in a Davies-Meyer construction. This creates a ~10-second cryptographic "tar pit" that makes brute-forcing a high-entropy key over UART impossible, while crippling the theoretical quadratic speed-up of Grover's algorithm.
2. Constant-Time MAC Verification: The engine uses a branchless 2's-complement mask (derived from the AVR NEG, SBC, COM trick) to verify the payload. No data-dependent branches mean no timing oracles.
3. Hardware-Hacking Resistant: Because the key is stretched and mixed into the CTR stream, even if an attacker uses EMFI/voltage glitching to bypass the MAC validation branch, the payload decrypts to randomized garbage. Cold-boot RAM extraction is useless because the memory wipe executes in constant time.
The repository includes a host-based mock hardware demo that runs the exact same engine directly in your terminal, plus a full RP2350 hardware implementation via USB CDC ACM.
If you're building secure bootloaders, dealing with bare-metal authentication, or running hardware hacking labs, pull the crate and test it out.
Source and full cryptographic design breakdown here: https://github.com/mytechnotalent/encryption
Also available natively on Crates.io: https://crates.io/crates/encryption
https://files.defcon.social/dcsocial-s3/media_attachments/files/116/873/152/652/650/903/original/22ca2c7562b517b3.png

2026-06-29 13:19:52 GMT

Today's Tutorial [June 29, 2026]
Lesson 230: Hacking Windows Course (Chapter 27: Debugging WriteFile x86)
Dynamic reverse engineering analysis, debugging, the Windows API WriteFile function in x86 Assembly.
#STEM #Windows #ReverseEngineering
https://github.com/mytechnotalent/Reverse-Engineering

2026-06-23 01:06:39 GMT

#DC540 #DEFCON chapter in Northern VA coming together to soldier the Mimic badge!
https://files.defcon.social/dcsocial-s3/media_attachments/files/116/796/737/976/973/965/original/28a1ea95e7861301.png
https://files.defcon.social/dcsocial-s3/media_attachments/files/116/796/738/347/221/481/original/e9835f4baa5d0427.png

2026-06-19 00:45:02 GMT

Little #BadgeLife preview of something I have been working on... https://youtu.be/stYTX0FJluE?si=JLgJ8D-REhs177W1

2026-06-01 23:09:38 GMT

#DC540 #DEFCON chapter helping with my companies badge dev! #badgelife
https://files.defcon.social/dcsocial-s3/media_attachments/files/116/677/369/789/846/872/original/7656defc463640ca.png

2026-04-10 09:50:23 GMT

- reply

agree that is terrible.

2026-01-25 14:46:06 GMT

In the Reverse Engineering world, we have a rule: You don't own it until you can take it apart.
The same applies to Artificial Intelligence.
We are currently drowning in API wrappers. Everyone is "building AI apps," but very few people are looking at the wiring underneath. To truly understand modern LLMs, I decided to stop using libraries. I went back to the drawing board to build a custom architecture from scratch.
Meet SARAN (Shallow Auto-Regressive Attention Network).
It’s not designed to beat GPT-4. It’s designed to be transparent. 🔹 I built a strict 15-stage computational graph. 🔹 I manually implemented backpropagation to trace the gradients. 🔹 I scaled it to a 354M parameter model to watch how it learns.
I’ve documented the entire build log—including the architecture decisions and the "why" behind the math—in my new engineering newsletter, Bits & Neurons.
If you want to move beyond the hype and understand the mechanics of AI, read the full breakdown here: https://mytechnotalent.substack.com
#ArtificialIntelligence #MachineLearning #DeepLearning #ReverseEngineering #Engineering #BuildInPublic
https://files.defcon.social/dcsocial-s3/media_attachments/files/115/956/276/376/816/071/original/eafe22cec7fab723.jpeg

2025-11-27 21:48:36 GMT

I’m some guy who wrote a reverse engineering tutorial because my brain gets stuck on problems until I tear them apart. That’s all. And every time I hear someone say they hate C, it still makes me shake my head. I love Rust. I fully embrace what it brings to the table, the safety, the guardrails, the way it keeps you from shooting yourself in the foot. It’s brilliant. But that doesn’t change the fact that C is like holding a knife when you carve the Thanksgiving turkey. It can cut you if you’re careless, but that doesn’t mean the knife is the problem. Somewhere along the line we stopped expecting developers to actually understand what they’re doing with memory or how the hardware works. Everything got padded with layers of safety and people forgot that responsibility is part of the job. I’m not trying to preach or act like some expert. I just miss when devs took ownership of their code and didn’t blame the language for mistakes that came from not learning how to handle the tools we use.

2025-08-26 11:34:53 GMT

- reply

hell yeah!

2025-08-25 23:43:51 GMT

- reply

as M.C. Shy D would say, “Gotta be tough”.

2025-08-25 23:33:15 GMT

New #DEFCON #DC540 space!
https://files.defcon.social/dcsocial-s3/media_attachments/files/115/092/015/633/075/153/original/0b19c3778d8f6ab5.png

2025-08-08 03:07:08 GMT

- reply

it’s all about the KEVOPS!

2025-08-07 16:26:38 GMT

Post linecon! Coffee time. #defcon33
https://files.defcon.social/dcsocial-s3/media_attachments/files/114/988/416/307/005/084/original/e2e1a906835a22f6.png

2025-07-28 23:29:08 GMT

Pre @npub1dqd…8xy4 #DEFCON #DC540 meeting we are all fired up for hacker summer camp!
https://files.defcon.social/dcsocial-s3/media_attachments/files/114/933/454/791/006/346/original/7f372afe75a8134c.png

2025-05-10 13:25:13 GMT

Excited to meet with the #DEFCON #DC801 group next Tuesday night and work with them on the 9th episode of the #DC540 CTF series! Story line included with binary in the repo attached. https://github.com/mytechnotalent/dc540-0x00009
https://files.defcon.social/dcsocial-s3/media_attachments/files/114/483/757/790/945/534/original/7dc60ccb77fe53d9.png

2025-04-29 16:15:04 GMT

@npub12ts…x422 being a Lacuna Coil fan have you heard this? Effing amazing! https://youtu.be/6clYGpgxDf8?si=AQ4qwN8_NfLVh6Sl

2025-04-27 13:24:18 GMT

FBI IC3: 2024 ransomware complaints on US critical infrastructure ↑9%, fueling record $16.6 B cyber losses. Crypto fraud +66% ($9.3 B); 60+ age group lost $4.8 B. Medusa variant still active despite global raids. #CyberSecurity #Ransomware https://www.reuters.com/world/us/complaints-about-ransomware-attacks-us-infrastructure-rise-9-fbi-says-2025-04-23/
https://files.defcon.social/dcsocial-s3/media_attachments/files/114/410/154/119/578/614/original/d787f6358b5e9085.jpeg

2025-04-15 12:41:10 GMT

Today we broke 12k stars on #GitHub remaining #1 on Reverse Engineering there and #1 for, “Reverse Engineering Tutorial” on Google. Thanks again for all of your continued support to help get new folks free training on #ReverseEngineering for everyone! https://github.com/mytechnotalent/Reverse-Engineering
https://files.defcon.social/dcsocial-s3/media_attachments/files/114/342/026/666/903/902/original/029429bc896220c6.png

2025-02-19 22:59:28 GMT

We are in the Age of Agentic AI.
Ladies and gentlemen, we stand at the dawn of something extraordinary—the birth of Embedded Reverse Engineering and Vulnerability Research in the Agentic AI generation.
For years, we’ve reverse-engineered binaries, unraveled obfuscation, and traced execution flows deep into silicon. But now, the game is changing. AI isn’t just a tool anymore—it’s an active agent, reasoning, adapting, and challenging assumptions in ways we’ve never seen before.
This is more than automation. It’s more than efficiency. It’s intelligence—embedded, autonomous, and evolving.
We are the pioneers in a field where AI meets hardware, where security meets intelligence, and where the vulnerabilities of today shape the resilience of tomorrow.
So here’s my challenge to you:
🔹 Push the boundaries of what’s possible.
🔹 Question the architecture of security itself.
🔹 Reimagine what AI-driven reverse engineering can achieve.
The next frontier isn’t just about finding flaws. It’s about understanding systems at a level deeper than ever before.
We are the ones forging this path. Let’s build the future. 🚀 #ReverseEngineering #VulnerabilityResearch #AgenticAI #CyberSecurity
https://files.defcon.social/dcsocial-s3/media_attachments/files/114/033/030/351/705/389/original/25aff4e599320ae5.png

2025-02-19 13:22:32 GMT

Today, Trend Micro reported that Mustang Panda (Earth Preta) is leveraging MAVInject.exe to bypass ESET antivirus, injecting malware into waitfor.exe to maintain persistence. This TONESHELL backdoor sideloads through OriginLegacyCLI.exe, targets Thailand-based users, and establishes C2 communication via militarytc[.]com.
ESET disputes this as a “bypass,” stating their protections have been in place for years. The real takeaway? Memorizing security policies won’t stop real attackers—understanding how they actually operate will.
APT groups innovate, exploit OS-native tools, and evade detection in ways policy documents can’t prepare you for. We need hands-on defenders who understand malware behavior, not just non-technical compliance checkboxes and certifications which focus on worthless memorization rather than understanding computer and network architecture.
#CyberSecurity #ThreatHunting #RedTeam #APT #MustangPanda #MAVInject #TONESHELL
https://thehackernews.com/2025/02/chinese-hackers-exploit-mavinjectexe-to.html

2025-02-12 23:55:19 GMT

On with my #meshtastic design work to help contribute to the #DEFCON @npub1dqd…8xy4 maker space. This time I created a local LLM that will communicate over the Long-Fast channel over serial. It is experimental but wanted to share with the community. https://github.com/mytechnotalent/sillmmcc
https://files.defcon.social/dcsocial-s3/media_attachments/files/113/993/614/430/018/705/original/4f2bf18a0c9064fd.png

2025-02-10 00:50:58 GMT

Hello @npub1dqd…8xy4 #DEFCON fam. I am working on an experimental #Meshtastic app using serial on Long Fast with the Python API. Here it is, it sorta works, and will be updating it soon. https://github.com/mytechnotalent/imcc

2025-01-02 02:09:11 GMT

“Reverse engineering 8-bit microcontrollers isn’t just about code—it’s about protecting systems that control our power grids, water supplies, and critical infrastructure. Every vuln uncovered could mean lives saved.” -K #ReverseEngineering #Embedded #SCADA #CyberSecurity #Safety
https://files.defcon.social/dcsocial-s3/media_attachments/files/113/756/323/619/358/589/original/f9be10b4f67b03d9.png

2024-11-23 16:34:34 GMT

- reply

very cool will definitely check this out!

2024-11-18 12:36:19 GMT

- reply

we are and will always be a committed family. I remember when defcon.social came into existence and the new friendships have made the DEFCON experience even richer. I believe this platform will only continue to grow as we have so much to learn and share with one another.

2024-11-14 14:12:37 GMT

- reply

I think under these circumstances of late it might have some real staying power.

2024-09-25 17:26:29 GMT

The world’s most popular Reverse Engineering Tutorial hits 11k stars on GitHub. Thank you all for your years of support! #reverseengineering https://youtu.be/Yz0zFsp0qzE?si=Dv3WBY4fm-Zfwzx0

2024-09-03 01:01:36 GMT

DC540 #DEFCON group Labor Day cookout! Hackers Unite!
https://files.defcon.social/dcsocial-s3/media_attachments/files/113/070/918/279/117/731/original/e88c67eb6ef7c0eb.png

2024-08-21 21:48:41 GMT

Thank you @npub1j6x…ef8k for showcasing our DC540 Chakra Badge at #DEFCON32! https://youtu.be/dSD-gdeT-k0?si=J98qTXBaUxwiAvY3&t=1152

2024-08-20 17:45:42 GMT

- reply

what about Whoosh? https://github.com/mchaput/whoosh